CVE-2024-2357
Medium · 6.5CVSS
6.5
EPSS
1.0%
Published
Mar 11, 2024
CISA due date
—
Cloudanix analysis
A bug in certain networking software used by automated systems can make it crash over and over when handling specific connection setups, stopping services until the software is updated.
- Exploitation
- Remote Authenticated
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- Network Service
- Class
- Denial of service
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
The vulnerability triggers repeated libreswan daemon restarts or crashes during IKEv2 retransmit handling for connections using authby=secret when no matching PreSharedKey is found, especially for connections started automatically via the auto= keyword.
Why it matters to the business
Results in denial of service that interrupts VPN or secure connectivity services in affected runner controller deployments, causing operational downtime for automated processes until the packages are updated.
How an attack unfolds
An attacker initiates IKEv2 sessions that provoke retransmission scenarios against a vulnerable auto-started connection lacking a matching secret, forcing the daemon into a crash-restart loop that sustains the denial of service.
How to fix it
Upgrade the affected packages to the fixed versions: actions-runner-controller (Chainguard) 0.8.3-r1, actions-runner-controller (Wolfi) 0.8.3-r1, actions-runner-controller-compat (Chainguard) 0.8.3-r1, and actions-runner-controller-compat (Wolfi) 0.8.3-r1.
How to confirm the fix worked
Confirm installed package versions meet or exceed the listed fixed releases and validate that auto-started connections no longer crash under IKEv2 retransmit testing.
Typical attack path
- Locate targets running vulnerable versions of the affected packages with auto-started connections configured for PreSharedKey authentication
- Send crafted or timed IKEv2 messages to trigger retransmit conditions without a matching secret
- Induce repeated crashes that prevent stable service operation
How to detect it
Review system and daemon logs for repeated libreswan restart or crash entries tied to IKEv2 retransmit events on auto-started connections.
What your security team should do
- Immediately upgrade all listed actions-runner-controller packages to version 0.8.3-r1 or newer
- Audit connection configurations to disable or correct auto= settings using authby=secret where possible
- Implement monitoring for unexpected daemon restarts until upgrades are complete
The record
The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot find a matching configured secret. When such a connection is automatically added on startup using the auto= keyword, it can cause repeated crashes leading to a Denial of Service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | libreswan | 0 | 4.12-2.el8_9.2.alma.1 |
| AlmaLinux:9 | libreswan | 0 | 4.12-1.el9_3.1.alma.1 |
| AlmaLinux:9 | libreswan | 0 | 4.12-2.el9_4.alma.1 |
| Debian:11 | libreswan | 0 | No fix |
| Debian:12 | libreswan | 0 | No fix |
| Debian:13 | libreswan | 0 | 4.14-1 |
| Mageia:9 | libreswan | 0 | 4.14-1.mga9 |
| Red Hat:enterprise_linux:8::appstream | libreswan | 0 | 0:4.12-2.el8_9.2 |
| Red Hat:enterprise_linux:8::appstream | libreswan-debuginfo | 0 | 0:4.12-2.el8_9.2 |
| Red Hat:enterprise_linux:8::appstream | libreswan-debugsource | 0 | 0:4.12-2.el8_9.2 |
| Red Hat:enterprise_linux:9::appstream | libreswan | 0 | 0:4.12-1.el9_3.1 |
| Red Hat:enterprise_linux:9::appstream | libreswan | 0 | 0:4.12-2.el9_4 |
| Red Hat:enterprise_linux:9::appstream | libreswan-debuginfo | 0 | 0:4.12-1.el9_3.1 |
| Red Hat:enterprise_linux:9::appstream | libreswan-debuginfo | 0 | 0:4.12-2.el9_4 |
| Red Hat:enterprise_linux:9::appstream | libreswan-debugsource | 0 | 0:4.12-1.el9_3.1 |
| Red Hat:enterprise_linux:9::appstream | libreswan-debugsource | 0 | 0:4.12-2.el9_4 |
| Red Hat:openshift:4.15::el9 | libreswan | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.15::el9 | libreswan-debuginfo | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.15::el9 | libreswan-debugsource | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.16::el9 | libreswan | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.16::el9 | libreswan-debuginfo | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.16::el9 | libreswan-debugsource | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.17::el9 | libreswan | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.17::el9 | libreswan-debuginfo | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.17::el9 | libreswan-debugsource | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:rhel_e4s:9.0::appstream | libreswan | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:rhel_e4s:9.0::appstream | libreswan-debuginfo | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:rhel_e4s:9.0::appstream | libreswan-debugsource | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:rhel_eus:8.6::appstream | libreswan | 0 | 0:4.5-1.el8_6.2 |
| Red Hat:rhel_eus:8.6::appstream | libreswan-debuginfo | 0 | 0:4.5-1.el8_6.2 |
| Red Hat:rhel_eus:8.6::appstream | libreswan-debugsource | 0 | 0:4.5-1.el8_6.2 |
| Red Hat:rhel_eus:8.8::appstream | libreswan | 0 | 0:4.9-3.el8_8.1 |
| Red Hat:rhel_eus:8.8::appstream | libreswan-debuginfo | 0 | 0:4.9-3.el8_8.1 |
| Red Hat:rhel_eus:8.8::appstream | libreswan-debugsource | 0 | 0:4.9-3.el8_8.1 |
| Red Hat:rhel_eus:9.2::appstream | libreswan | 0 | 0:4.9-5.el9_2.1 |
| Red Hat:rhel_eus:9.2::appstream | libreswan-debuginfo | 0 | 0:4.9-5.el9_2.1 |
| Red Hat:rhel_eus:9.2::appstream | libreswan-debugsource | 0 | 0:4.9-5.el9_2.1 |
| Rocky Linux:8 | libreswan | 0 | 0:4.12-2.el8_9.2 |
| Rocky Linux:9 | libreswan | 0 | 0:4.12-2.el9_4 |
| Ubuntu:18.04:LTS | libreswan | 0 | No fix |
| Ubuntu:20.04:LTS | libreswan | 0 | No fix |
| Ubuntu:22.04:LTS | libreswan | 0 | No fix |
| Ubuntu:24.04:LTS | libreswan | 0 | No fix |
| Ubuntu:24.10 | libreswan | 0 | 4.14-1ubuntu2 |
| Ubuntu:Pro:18.04:LTS | libreswan | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | libreswan | 0 | No fix |